# Encryption

> **Status:** Placeholder. Content currently lives inline in [approvals-and-annotations](approvals-and-annotations.md) and [enforcement](enforcement.md). A dedicated page will extract the AES-256-GCM, envelope encryption, and key rotation sections.

## Quick Reference

TnsAI uses **AES-256-GCM** for at-rest encryption of sensitive fields. Keys are managed via an envelope pattern (data key + master key).

See [Enforcement](enforcement.md) for the current encryption section.

## Planned Content

- AES-256-GCM setup.
- Envelope encryption (data encryption key + master key).
- Key rotation.
- Integration with external KMS.